# Installed Package API integrations and SFTP

*Marketing Cloud Engagement Administrator Study Guide · Setup · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator/setup/installed-package-api-integrations-and-sftp*

How to choose and configure an Installed Packages API integration (Server-to-Server, Web App or Public App), where the client ID and secret come from, how token requests use v2/token, scope and account_id, and how the Marketing Cloud Engagement SFTP server, SFTP accounts, SSH keys and file locations work, with their limits.

- Certification: Salesforce Marketing Cloud Engagement Administrator
- Exam section: Setup
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator

**Official exam objective:**

> Given a scenario, determine how to configure integrations.

## What the exam expects

- Choose the Installed Packages integration type (Server-to-Server, Web App, Public App) from whether a user is present and whether the app can keep a secret.
- Explain where the client ID and secret come from and what a token request needs: v2/token on the Authorization Base URI, scope, account_id, and a 20-minute token that is reused.
- Configure SFTP: port, separate credentials, connection and lockout limits, folders, retention, filename rules, SSH keys and account limits.
- Tell SFTP Accounts (the Engagement-hosted server) from Authorizing File Locations (external storage).
- Key terms: **installed package** (a bundle of components such as an API integration); **client credentials** (grant with no user); **authorization code** (grant where a user logs in); **Authorization Base URI** (tenant-specific auth endpoint); **MID** (a business unit's account ID).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Unattended integration | Server-to-Server, client_credentials grant | [Access Token for S2S](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| User-authorized integration | Web App or Public App, authorization code grant | [Web and Public App Integrations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-app-auth-code.html) |
| Client ID and secret | Generated when the API integration is created in Installed Packages | [S2S Client Credentials](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-s2s-client-credentials.html) |
| Token endpoint | v2/token on the Authorization Base URI | [Access Token for S2S](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| Token lifetime | 20 minutes, reusable; refresh two minutes early | [Access Token for S2S](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| Child business unit | account_id set to the unit's MID | [Access Token for S2S](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| SFTP port and lockout | Port 22; 30-minute block after too many bad passwords | [SFTP Accounts](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_ftp_accounts.htm&language=en_US&type=5) |
| SFTP retention | At least 21 days | [SFTP Accounts](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_ftp_accounts.htm&language=en_US&type=5) |
| SFTP users | Up to 10 active per MID | [Create SFTP User Accounts](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_add_ftp_accounts.htm&language=en_US&type=5) |
| External S3 bucket | Authorizing File Locations | [Authorizing File Locations](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_file_locations.htm&language=en_US&type=5) |

## Check yourself

- Why must a single-page app use a Public App integration?
- When does a token request work in a business unit other than the one that created the integration?
- Why save the client secret as soon as the component is created?
- Which Automation Studio activities work with the SFTP server?

## Sources

- [Access Token for Server-to-Server Integrations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html)
- [Installed Package Definitions](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/installed-packages-definitions.html)
- [API Integration](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/api-integration.html)
- [Create an OAuth 2.0 API Integration in Enhanced Packages](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/create-integration-enhanced.html)
- [Server-to-Server Integrations with Client Credentials Grant Type](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-s2s-client-credentials.html)
- [Web and Public App Integrations with Authorization Code Grant Type](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-app-auth-code.html)
- [SFTP Accounts in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_ftp_accounts.htm&language=en_US&type=5)
- [Create SFTP User Accounts](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_add_ftp_accounts.htm&language=en_US&type=5)
- [SSH Keys for SFTP](https://help.salesforce.com/s/articleView?id=mktg.mc_es_sftp_ssh.htm&language=en_US&type=5)
- [Authorizing File Locations](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_file_locations.htm&language=en_US&type=5)
- [Marketing Cloud Engagement Setup](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_administration.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 19 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Administrator pack (USD $19): https://www.certifyforce.com/practice-exams